No cookies, no fingerprinting
No localStorage, no canvas, audio or WebGL probing. Nothing is stored on or read from the device — so the consent requirement of § 25 TDDDG does not apply.
Proof-of-work captcha · Hosted in Falkenstein, Germany
Invisible to humans.
Expensive for bots.
simplecaptcha protects forms with an invisible computation instead of image puzzles. Your visitors notice nothing — no clicks, no cookies, no consent banner. GDPR-compliant, hosted exclusively in Germany.
- 0 cookies
- 0 image puzzles
- ~1 s of background compute
- § 25 TDDDG: no consent required
Live demo
Watch the invisible work
This form is protected by simplecaptcha. Click into a field: your browser starts solving a memory-hard Argon2id challenge in the background. On the right you see what nobody else does.
Contact form (protected)
simplecaptcha test bench
ready — waiting for the first interaction with the form
The live demo is currently unreachable. The principle stays the same: the computation runs invisibly while your visitors type — the mechanics are explained step by step below.
This demo runs against the real API at api.simplecaptcha.de — the same two-line integration you would use.
How it works
Two lines in the frontend, one call in the backend
Integration is three steps. The widget handles the first two by itself — the third one is yours, and it is the one that counts.
-
Add the script
Mark your form with
data-simplecaptchaand add the script tag. No layout changes, no visible element.<form data-simplecaptcha>…</form> <script src="https://api.simplecaptcha.de/v1/widget.js" data-sitekey="sck_…" defer> </script> -
Invisible work
On the first interaction, the browser solves a memory-hard Argon2id challenge in the background — done before your visitors finish typing. The result lands in the form as a token.
-
Verify server-side
Your server verifies the token once against
/v1/siteverify. Without this call there is no protection at all — which is why we say it this plainly.curl -X POST \ https://api.simplecaptcha.de/v1/siteverify \ -d "secret=scs_…" \ -d "response=TOKEN"
Privacy
GDPR-compliant without a consent banner — verifiably
The claim "no consent banner needed" only holds if, technically, nothing happens that would require consent. That is exactly how simplecaptcha is built.
Visitor data: ephemeral, Germany only
IP addresses exist only as salted hashes in counters with minute-level TTLs. No database table with visitor data exists. Processing under Art. 6(1)(f) GDPR (Recital 49).
Accessible by construction
No puzzle, no interaction, nothing to see or hear — invisible is inherently accessible. Since the BFSG (European Accessibility Act) took effect in June 2025, image-puzzle captchas are a legal risk.
Visitor path
Captcha traffic: Germany/EU only
Hetzner (Falkenstein/Nuremberg). No US CDN, no Cloudflare — "hosted in Germany" survives a look at the DNS records.
Customer path
Account & billing: pragmatic, disclosed
Stripe (payment), Clerk (login), Resend (email) — they process your account data only, never visitor data. DPA with subprocessor list at signup.
Pricing
One price, no dark patterns
You are billed for the /siteverify call only — auditable from your own server logs. Bot storms and abandoned forms cost you nothing.
Free
€0 / month
- 500 verifications per month
- 1 domain
- Test keys for localhost & CI
- No credit card required
Pro
€9 / month
- 1,000 verifications included
- Then €0.007 per verification
- Multiple domains & sitekeys
- Billing via Stripe, monthly invoice
Quota exhausted? You are warned repeatedly (80%, 100%, 14-day grace period), and /siteverify returns the distinct quota-exceeded error code — never a generic failure. Your forms can keep working instead of blocking real customers. Recommended pattern in the docs.